Hello.
The attached test-case demonstrates a
bug in mremap(). If MREMAP_FIXED is used
over an existing mapping and mremap() fails,
destination area gets unmapped.
AFAIK the failed syscall should have no
observable effects.
There is also another bug demonstrated by
the same test-case. Namely, it does 2 subsequent
mprotect()s on the same page, changing the
protection and restoring it back. But VMAs
are not merged, so the subsequent mremap()
fails (and exhibits a bug by unmapping dest).
On 30.03.23 17:48, stsp wrote:
> Hello.
>
> The attached test-case demonstrates a
> bug in mremap(). If MREMAP_FIXED is used
> over an existing mapping and mremap() fails,
> destination area gets unmapped.
> AFAIK the failed syscall should have no
> observable effects.
I remember that holds for various mapping-related syscalls: if something
goes wrong, the end result is not guaranteed to be what we had before
the syscall.
For example, if you use mmap(MAP_FIXED) to replace part of an exiting
mapping, we first munmap what's there and then try to mmap the new
mapping. If something goes wrong while doing that, we cannot simple undo
what we already did.
Long story short: the semantics of these syscalls has never been to
leave the system in the state as it was before in case anything goes wrong.
As another example, if you do an mprotect() that covers multiple VMAS,
and there is an issue with the last VMA, all but the last VMA will have
their permissions changed.
--
Thanks,
David / dhildenb
Hi,
03.04.2023 16:58, David Hildenbrand пишет:
> On 30.03.23 17:48, stsp wrote:
>> Hello.
>>
>> The attached test-case demonstrates a
>> bug in mremap(). If MREMAP_FIXED is used
>> over an existing mapping and mremap() fails,
>> destination area gets unmapped.
>> AFAIK the failed syscall should have no
>> observable effects.
>
> I remember that holds for various mapping-related syscalls: if
> something goes wrong, the end result is not guaranteed to be what we
> had before the syscall.
>
> For example, if you use mmap(MAP_FIXED) to replace part of an exiting
> mapping, we first munmap what's there and then try to mmap the new
> mapping. If something goes wrong while doing that, we cannot simple
> undo what we already did.
>
> Long story short: the semantics of these syscalls has never been to
> leave the system in the state as it was before in case anything goes
> wrong.
>
>
> As another example, if you do an mprotect() that covers multiple VMAS,
> and there is an issue with the last VMA, all but the last VMA will
> have their permissions changed.
>
Thanks for info.
Is this documented in a man page?
I wonder how do you deal with mmap() and
mprotect() on such occasions. mremap()
is an extension, but mmap() and mprotect()
are from posix, so is it a compliant impl?
Also my example shows another bug
that the VMAs are not merged after I
restore the protection of one of them,
allowing them to merge.